pmnormalize: Log Message Normalization parser#

Module Name:	pmnormalize
Author:	Pascal Withopf <pascalwithopf1@gmail.com>
Available since:	8.27.0

Normalizes incoming messages with liblognorm and can emit per-parser liblognorm debug records to rsyslog diagnostics or a dedicated file.

Purpose#

This parser normalizes messages with the specified rules and populates the properties for further use.

Configuration Parameters#

Note

Parameter names are case-insensitive; camelCase is recommended for readability.

Parser Parameters#

rulebase#

type	default	mandatory	`obsolete legacy` directive
word	none	no	none

Specifies which rulebase file is to use. If there are multiple pmnormalize instances, each one can use a different file. However, a single instance can use only a single file. This parameter or rule MUST be given, because normalization can only happen based on a rulebase. It is recommended that an absolute path name is given. Information on how to create the rulebase can be found in the liblognorm manual.

rule#

type	default	mandatory	`obsolete legacy` directive
array	none	no	none

Contains an array of strings which will be put together as the rulebase. This parameter or rulebase MUST be given, because normalization can only happen based on a rulebase.

undefinedPropertyError#

type	default	mandatory	`obsolete legacy` directive
binary	off	no	none

With this parameter an error message is controlled, which will be put out every time pmnormalize can’t normalize a message.

debug#

type	default	mandatory	`obsolete legacy` directive
binary	off	no	none

Enables verbose liblognorm debugging for this parser. By default, trace records are sent to rsyslog’s internal diagnostic stream.

RainerScript usage:

parser(name="custom.pmnormalize" type="pmnormalize"
       rulebase="/path/to/rules.rb" debug="on")

YAML usage:

parsers:
  - name: custom.pmnormalize
    type: pmnormalize
    rulebase: /path/to/rules.rb
    debug: on

debugFile#

type	default	mandatory	`obsolete legacy` directive
word	none	no	none

Redirects this parser’s liblognorm debug records to the specified append-only file. Requires debug=”on” and causes configuration to fail if the file cannot be opened.

RainerScript usage:

parser(name="custom.pmnormalize" type="pmnormalize"
       rulebase="/path/to/rules.rb" debug="on"
       debugFile="/path/to/pmnormalize-debug.log")

YAML usage:

parsers:
  - name: custom.pmnormalize
    type: pmnormalize
    rulebase: /path/to/rules.rb
    debug: on
    debugFile: /path/to/pmnormalize-debug.log

Examples#

Normalize messages with rulebase#

In this sample messages are received via imtcp. Then they are normalized with the given rulebase and written to a file.

module(load="imtcp")
module(load="pmnormalize")

input(type="imtcp" port="13514" ruleset="ruleset")

parser(name="custom.pmnormalize" type="pmnormalize" rulebase="/tmp/rules.rulebase")

ruleset(name="ruleset" parser="custom.pmnormalize") {
     action(type="omfile" file="/tmp/output")
}

Normalize messages with rules specified#

Same as above, but messages are normalized with the given rule array.

module(load="imtcp")
module(load="pmnormalize")

input(type="imtcp" port="10514" ruleset="outp")

parser(name="custom.pmnormalize" type="pmnormalize" rule=[
             "rule=:<%pri:number%> %fromhost-ip:ipv4% %hostname:word% %syslogtag:char-to:\\x3a%: %msg:rest%",
             "rule=:<%pri:number%> %hostname:word% %fromhost-ip:ipv4% %syslogtag:char-to:\\x3a%: %msg:rest%"])

ruleset(name="outp" parser="custom.pmnormalize") {
     action(type="omfile" File="/tmp/output")
}

Support: rsyslog Assistant | GitHub Discussions | GitHub Issues: rsyslog source project

Contributing: Source & docs: rsyslog source project